Stay At Home

Beware: This fake VPN installer is stealing users’ passwords


If you’re looking to download ProtonVPN software, be careful — there’s a fake version of the popular VPN client that infects your computer with malware designed to steal your passwords and any Bitcoin you might have lying around.Kaspersky researchers reported yesterday (Feb. 18) that Russian miscreants had copied the real ProtonVPN site at wholesale and posted an exact duplicate at protonvpn-dot-store. The crooks lured victims to the phony ProtonVPN site with malicious banner ads on other websites.

But if you clicked the big green “Get ProtonVPN Now” button in the middle of page, you’d download something that looked like a ProtonVPN installer yet was in fact the AZORult Trojan, a notorious information-stealer.


  • Best VPN: Secure your connections
  • The best free VPN services: Privacy on the cheap
  • WireGuard will make your VPN connection much faster — here’s how

“The threat actors have designed the malware to steal cryptocurrency from locally available wallets (Electrum, Bitcoin, Etherium, etc.), FTP logins and passwords from FileZilla, email credentials, information from locally installed browsers (including cookies), credentials for WinSCP, Pidgin messenger and others,” wrote Kaspersky’s Dmitry Bestuzhev.